openshift Archives - CVE Vulnerability

CVE-2019-3884

Sun, 26 Feb 2023 06:33:15 +0000

A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects. Versions 3.6, 3.7, 3.8, 3.9, 3.10, 3.11 and 4.1 are affected.

The post CVE-2019-3884 appeared first on CVE Vulnerability.

CVE-2021-4125

Thu, 23 Feb 2023 14:11:57 +0000

It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.

The post CVE-2021-4125 appeared first on CVE Vulnerability.

CVE-2022-43922

godfreyd94 — Thu, 23 Feb 2023 05:21:13 +0000

IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak hash of an API Key in the configuration. IBM X-Force ID: 241583.

The post CVE-2022-43922 appeared first on CVE Vulnerability.

CVE-2022-42439

godfreyd94 — Thu, 23 Feb 2023 05:21:00 +0000

IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which may cause a 3rd party system’s credentials to be exposed to a privileged attacker. IBM X-Force ID: 238211.

The post CVE-2022-42439 appeared first on CVE Vulnerability.

CVE-2022-41731

godfreyd94 — Thu, 23 Feb 2023 05:20:51 +0000

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 237402.

The post CVE-2022-41731 appeared first on CVE Vulnerability.

CVE-2023-0296

godfreyd94 — Wed, 22 Feb 2023 14:02:13 +0000

The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy, hence this port might be considered as still vulnerable to the same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), therefore the potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component.

The post CVE-2023-0296 appeared first on CVE Vulnerability.